CVE-2026-18969

CVE-2026-18969 – Rongzhitong Visual Integrated Command and Dispatch Platform A vulnerability exists in the file upload path /dm/dispatch/userinfo/upload where argument manipulation of the File parameter enables unrestricted uploads. This could allow remote initiation of an attack with no required...

GHSA-RQ84-P6RR-VF89 Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of...

CVE-2026-70482

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.0, when ENABLEOAUTHTOKENEXCHANGE=True, /oauth/provider/token/exchange accepts a raw provider access token and validates it by calling the provider userinfo endpoint without confirming which...

PT-2026-66646

Summary is url safe in v1.0.3 contains an SSRF bypass. remove at symbol in string is applied to the raw URL string before new URL parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked. Vulnerability In helpers.ts, is url safe doe...

CVE-2026-58156

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-58156

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-58156 Apache Traffic Server: URL and port parsing errors allow access-control bypass

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-58156

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-58156

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

Linux Distros Unpatched Vulnerability : CVE-2026-58156

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0...

CVE-2026-17552

Plack::App::Prerender versions before 0.3.0 for Perl are vulnerable to a Server-Side Request Forgery (SSRF) due to unvalidated REQUEST_URI concatenation in the call() function. When the rewrite base is a plain string without a path, the software fails to verify that the path starts with a forward...

GO-2026-6065 Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev...

GHSA-MG4F-X9V4-6H2P Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the GET /login/oauth/userinfo endpoint. An attacker can access identity claims such as email and groups by supplying a personal access token with insufficient scopes as a bearer...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the GET /login/oauth/userinfo endpoint. An attacker can access identity claims such as email and groups by supplying a personal access token with insufficient scopes as a bearer...

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

Summary The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but does not enforce API token scopes before returning identity claims. A personal access token scoped only to read:misc can successfully retrieve user information from the OIDC userinfo...

PT-2026-63279

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The OIDC userinfo endpoint GET /login/oauth/userinfo accepts Gitea API tokens as bearer credentials but fails to enforce API token scopes before returning identity claims. This allows a token...

PT-2026-67319

Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.14.2 Description The built-in cURL handlers CurlHandler and CurlMultiHandler fail to properly isolate Proxy-Authorization headers from origin servers. This occurs because the handlers place first-class...

CVE-2026-13410

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialised with SSLverifymode explicitly disabled. An attacker with network man-in-the-middle MITM capability between the Dancer application and googleapis.com can intercept the...

CVE-2026-13410

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSLverifymode explicitly disabled. An attacker with network man-in-the-middle MITM capability between the Dancer application and googleapis.com can intercept the...